Skip to content

v0.12.2

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Nov 06:52
· 3909 commits to main since this release
v0.12.2
b659923

A second hot patch for 0.12.0, on top of 0.12.1: Kiro Crew no longer restarts a running gateway to install an update, chats keep their approvals, queued messages and streams straight under failures, and the KAS engine reads more of a kiro-cli agent spec. Slack, Teams, Telegram and Discord keep each turn's reply in the right place, and security, Windows, cloud crew and accessibility fixes land with them. The Decisions model card gains a SageMaker endpoint option.

Updates

Kiro Crew never restarts a running gateway to install an update. A new version downloads in the background, clicking Update only marks it for the next start, and the desktop app installs it when you quit. An install that was interrupted finishes at the next app start before the gateway starts, and the agent cannot write the record that arms an update.

Notable fixes

Chat and sessions. An old approval answer no longer approves a later tool, approval cards stay answerable when a stop fails, and a streaming turn keeps running when its send fails late. A closed tab stays closed when its late save lands, a requeued message runs on its own row instead of a duplicate, a resume joins the agent already starting, and the reply that streamed before a compaction is kept. The agent greeting shows early, mermaid label images no longer load on render, and clicking a linked image opens only the viewer.

KAS engine. A kiro-cli agent's allowedCommands patterns (\d, \s, \w, {n,m} and Rust style expressions) and read allowedPaths are honoured at Crew's gate, shell allowlist grants survive a policy that pins built-in rules, and trustedAgents allows apply after every deny. An mcp.json tools allowlist and useLegacyMcpJson are read, a project agent file can switch a user-level MCP server off, a model pin the KAS model list does not offer is refused, a host with a too-old glibc is refused before the install begins, and a broken engine copy that kiro-cli left behind is moved aside once. Steering files that may be auto-included are sent by path instead of the whole tree, a runtime start no longer waits on an empty tree scan, spec hook context is sent again after a compaction, and Crew's MCP servers connect before the agent's own.

Claude and other harnesses. A start that dies at once reports the real exit status, a failed kiro sign-in is reported as unfinished with a one click retry, and a kiro-cli engine the host cannot run is reported as such. A Kiro CLI that rejects --auth-method is told once to update, its out of date card lifts when config leaves the KAS relay, and KAS users reach the Kiro sign-in from the account popup, where a bare refusal names the start URL before the region. A Claude session that asks for auto approval keeps Crew's tools beside a foreign settings file, cli.json is kept whole when the gateway cannot read it, and Codex Crew servers carry the gateway instance environment.

MCP servers. A user MCP server whose name contains a colon stays in the default agent spec, a Windows launcher is probed once whatever its spelling, a copied gateway entry drops its provenance records, and a dead pooled backend is named. The launch approval and settings cards of the MCP gateway behave, a KAS MCP sign-in is saved where KAS chats read it, a remote server's sign-in settings always reach the engine, and KAS says when it cannot sign in to a server with its own client. A KAS MCP server's launch reference is shared across sessions, and a conductor is told which of its worker's MCP servers failed.

Bots, crews and the work ledger. The Bot editor, agent picker and roster get four fixes, a Bot whose memory database was deleted reopens, and a .kirobot file that starts with a byte-order mark imports. A new chat never suggests a Bot's home folder, a Bot chat outside its own thread is told to do the work itself, and the custom agents tab lists spec files it used to hide while reserving their names. A folder agent named like a Bot is asked about instead of rewritten, the crew log writes its savepoints when a unit grew during the pass, and the work ledger says when an undo removed a write.

Schedules. Credential failures no longer count toward a job's automatic pause, stateless runs stay out of the session search window, and a run cut off by a restart is reported as such. A deeply nested crons.json value no longer blocks every save, and a scheduled approval mode of auto is refused when it comes from an app token. A HEARTBEAT.md saved with a byte-order mark is read like any other, and a paused job's cut run no longer promises a next run.

Security. Several file, link and permission checks are tightened on Windows and in the dashboard, including junctions, middle link folders, fixed tool lookups, file search scope, a file read check and a channel member check. The dashboard no longer trusts localhost:3000 just because a data home is set, boot.allow_terminal refuses the dashboard terminal, and credentials are masked in long capability messages. Outlook's own links pass the link guard, an oauth_endpoints.json entry can clear a client id that was held back, and a shell call's recovered command is judged under the policy commands.

Channels. Slack keeps a review draft when posting or approving it fails, and an approval click stays on the chat that asked. Teams and Telegram keep a later turn's reply when an earlier turn ends, Discord starts a fresh session when its resume host stays unreachable and opens no new connection after closing, and a quoted directive line is dropped from channel replies. Slack formatted messages are legible in the bell, a linked Slack thread's turns run with the Slack runtime, and a channel's challenge prompt is no longer echoed into its thread.

Cloud, pods and remote crews. A cloud launch into an account without a host policy is refused, a denied launch names the action and points to the IAM policy, and end of input at a yes/no prompt counts as no. The cursor menu picks items past nine by number, only resumable found stacks are offered and never preselected, and list, status and destroy agree about a removed crew. A silent SSM crew or an origin refusal is explained instead of reported as a bad credential, remote crews forward every pane port, the SSH tunnel is marked unsupported on a Windows gateway, and a pod reports a systemctl or journalctl timeout and refuses a name with a trailing newline.

Gateway, update checks and desktop app. An update check lets its fetch finish and cleans up after a cancel, refuses an offer from a channel you left, and words each refusal clearly. A stable release now reaches the insider index and image, one failing cleanup step no longer skips the rest when the gateway stops, a refused systemd stop is reported instead of success, and dashboard sign-in writes and status reads no longer block the gateway. The desktop app bounds and rotates its gateway launch log, keeps its supervision steady, kills a hung renderer under Rosetta, and retries Windows installs through a brief file hold, and setup no longer asks for node on the bundled KAS route.

Memory, knowledge and skills. A knowledge folder keeps a file its scan could not see, the embedding rate limit lets one waiter through per token, and a Bedrock knowledge base counts each id once toward its cap. Office-held files open in the viewer and memory locks are kept. A transcript row with no role no longer stops context from reading on, and crystallize is told the candidate layout.

Monitoring and workflows. A GitHub pull request with over 100 passing checks counts as review ready, a rate limit stays retryable, and a GitLab merge request is reported as conflicting behind another blocker. Only the newest Azure DevOps status per check counts. A cancelled step fails in workflows and in task runner parallel groups, and saved task plans are refused while the task runner is off.

Dashboard, keyboard and languages. Delete, knowledge, Capabilities, Memory and issue radar buttons keep keyboard focus while they work, and the account Refresh button fits its label. The dictation preview keeps its line breaks, the /connections redirect keeps its query, and an SVG artifact keeps its stylesheet off the page around it. The crew board's failed attempts count is pluralized, desktop file links with a drive letter open, a link preview falls back when a title is blank, and creating a worktree names git's reason when it refuses.

Decisions model. The Decisions model card offers a SageMaker endpoint option with an endpoint name and region, and hosted options the organization's ceiling refuses are hidden. A refused configured endpoint reads as No model, and turning on consent for a refused host is refused.

What's Changed

Full Changelog: v0.12.1...v0.12.2

Contributors

bolichen97 and buluoray
Assets 24
Loading